@adcp/sdk API Reference - v7.9.0
    Preparing search index...

    Interface AgentOAuthClientCredentials

    OAuth 2.0 client credentials grant configuration (RFC 6749 §4.4).

    For machine-to-machine authentication where no user is present — the library exchanges the client ID + secret directly with the authorization server. Tokens are cached in AgentConfig.oauth_tokens and re-exchanged by ensureClientCredentialsTokens when they near expiry.

    Secret values (client_id, client_secret) may be either literal strings or env-var references in the form $ENV:VAR_NAME. References are resolved at token-exchange time by resolveSecret, so secrets never need to land on disk for CI use cases.

    const credentials: AgentOAuthClientCredentials = {
      token_endpoint: 'https://auth.example.com/oauth/token',
      client_id: 'abc123',
      client_secret: 'shh-its-a-secret',
      scope: 'adcp',
    };

    const credentials: AgentOAuthClientCredentials = {
      token_endpoint: 'https://auth.example.com/oauth/token',
      client_id: 'abc123',
      client_secret: '$ENV:ADCP_CLIENT_SECRET',
      scope: 'adcp',
      audience: 'https://agent.example.com',
    };
    interface AgentOAuthClientCredentials {
        token_endpoint: string;
        client_id: string;
        client_secret: string;
        scope?: string;
        resource?: string | string[];
        audience?: string;
        auth_method?: "basic" | "body";
    }
    Index

    Properties

    token_endpoint client_id client_secret scope? resource? audience? auth_method?

    Properties

    token_endpoint: string

    Authorization server token endpoint. Must be HTTPS unless it points at localhost / 127.0.0.1 (dev/test carve-out). The exchange helper rejects non-HTTPS URLs at runtime to keep the client secret off the wire in plaintext.

    client_id: string

    OAuth client ID. May be a $ENV:VAR reference.

    client_secret: string

    OAuth client secret. May be a $ENV:VAR reference.

    scope?: string

    Requested OAuth scope (space-delimited for multiple).

    resource?: string | string[]

    RFC 8707 resource indicator(s). Advertises the protected resource the issued token will be used against, so the AS can mint an audience-bound token. Required by some AS deployments (Keycloak in strict mode, AWS Cognito with resource servers) when the agent is behind a proxy that validates aud. Accepts a single URI or an array — the library sends one resource form field per entry.

    audience?: string

    Audience parameter. Non-standard in RFC 6749 but widely supported by Auth0, Okta, and Azure AD as the preferred way to request an audience-bound token. Send this when the AS documentation calls for audience=; otherwise prefer resource (RFC 8707).

    auth_method?: "basic" | "body"

    Where to put client credentials on the token request.

    • basic (default): HTTP Basic Auth header (RFC 6749 §2.3.1 preferred).
    • body: client_id / client_secret form fields in the body.

    RFC 6749 says servers MUST support Basic and MAY support body — a few popular providers only accept body, so this toggle exists.

    Settings

    Member Visibility

    On This Page

    Properties